It looks like the issue is that in the plugin execution order, rewrite takes place much earlier than basicauth does, so when Caddy is performing the rewrite and checking {user}, the placeholder has not been set yet.

The order of execution is pretty important, but I don’t know if it’s done purposely to have basicauth happen after rewrite. You’ve got a good use case for it being the other way around - I’d open up an issue and ask, so the Caddy developers and collaborators can have a look and determine a conclusion. Modifying the order has lots of potential other effects, and could break other use cases, so it’ll probably bear some discussion.